Elastic Compute Service (ECS) secrets store the passwords and SSH key pairs that are used for authentication when you log on to ECS instances. Secrets Manager supports periodic rotation and immediate rotation of secrets that are managed in Secrets Manager. This helps reduce the risk of secret leaks. This topic describes how to manage and use ECS secrets.
Overview
To use an ECS secret, you must grant Secrets Manager the permissions to manage the passwords and SSH key pairs of ECS instances. When you log on to the ECS instances, you can retrieve the required secrets from Secrets Manager.
When the periodic rotation and immediate rotation of an ECS secret is triggered, Secrets Manager sends a secret rotation command to Cloud Assistant. Then, Cloud Assistant calls the secret plug-in installed on the ECS instance for which the ECS secret is created to complete the secret rotation. After the ECS secret is rotated, you can use the new secret to log on to the ECS instance.
After an ECS secret is rotated, the password or SSH key pair of the ECS instance for which the secret is created is also updated. If you delete an ECS instance that is associated with a secret, the secret rotation may fail. We recommend that you do not delete the ECS instance that is associated with a secret.
Limits
Linux-based ECS instances support the rotation of passwords and SSH key pairs, whereas Windows-based ECS instances support the rotation of only passwords.
Prerequisites
A KMS instance is created and enabled. For more information, see Purchase and enable a KMS instance.
A key is created. For more information, see Getting started with keys.
An ECS instance is created. For more information, see Create an ECS instance.
If you use a RAM user or a RAM role to manage ECS secrets, the AliyunKMSSecretAdminAccess system policy is attached to the RAM user or the RAM role. For more information, see Grant permissions to a RAM user or Grant permissions to a RAM role.
Step 1: Create an ECS secret
When you create a secret, you can configure automatic rotation for the secret. This helps reduce the risk of secret leaks.
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Secrets.
Click the ECS Secrets tab, select the required instance ID from the Instance ID drop-down list, and then click Create Secret. Then, configure the parameters and click OK.
Parameter
Description
Secret Name
The name of the secret.
Managed Instance
The existing ECS instance that you want to manage within your Alibaba Cloud account.
Managed User
The name of an existing user on the ECS instance, such as the root user for Linux operating systems or the Administrator user for Windows operating systems.
Initial Secret Value
The value cannot exceed 30,720 bytes in length, which is equivalent to 30 KB in size.
Password: the password of the user that is used to log on to the ECS instance.
Key Pair: the SSH key pair of the user that is used to log on to the ECS instance.
NoteEnter a valid secret value. If you enter an invalid secret value, the password or key pair that you retrieve from KMS cannot be used to log on to the ECS instance before the first time the ECS secret is rotated.
CMK
The key that is used to encrypt the secret.
ImportantYour key and secret must belong to the same KMS instance. The key must be a symmetric key. For more information about the symmetric keys supported by KMS, see Key types and specifications.
Tag
The tag that you want to add to the secret. You can use tags to classify and manage secrets. A tag consists of a key-value pair.
NoteA tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal sign (=), colons (:), and at signs (@).
A tag key cannot start with aliyun or acs:.
You can configure up to 20 key-value pairs for each secret.
Automatic Rotation
Specifies whether to enable automatic secret rotation.
Rotation Period
The interval of automatic secret rotation. This setting is required only when you select Enable Automatic Rotation. The value ranges from 1 hour to 365 days.
KMS periodically updates the secret based on the value of this parameter.
Description
The description of the secret.
Advanced Settings
The policy settings of the secret.
Default Policy: If the secret is used by the current Alibaba Cloud account or the Alibaba Cloud account in a resource share, select Default Policy.
If the KMS instance is not shared with other accounts, only the current Alibaba Cloud account can manage and use the secret.
If the KMS instance is shared with other accounts, the supported operations vary. For example, an instance named KMS Instance A is shared with Alibaba Cloud Account 2 by using Alibaba Cloud Account 1.
Secrets created by Alibaba Cloud Account 1: Only Alibaba Cloud Account 1 can manage and use the secrets.
Secrets created by Alibaba Cloud Account 2: Both Alibaba Cloud Account 1 and Alibaba Cloud Account 2 can manage and use the secrets.
Custom Policy: If you want to grant permissions to a Resource Access Management (RAM) user, RAM role, or other accounts to use the secret, select Custom Policy.
ImportantAdministrators and users do not consume Access Management Quota. Cross-account users consume Access Management Quota of the KMS instance. The consumed quota is calculated based on the number of Alibaba Cloud accounts. If you revoke the permissions, wait approximately 5 minutes and then query the quota. The consumed quota is restored.
When you use a secret, you must have the permission to use the required key to decrypt the secret.
An administrator can manage the secret but cannot retrieve the secret value. You can select RAM users and RAM roles within the current Alibaba Cloud account.
A user can retrieve the secret value. You can select RAM users and RAM roles within the current Alibaba Cloud account.
A cross-account user can retrieve the secret value. You can select RAM users and RAM roles within other Alibaba Cloud accounts.
RAM user: The name of the RAM user is in the
acs:ram::<userId>:user/<ramuser>
format. Example:aacs:ram::119285303511****:user/testpolicyuser
.RAM role: The name of the RAM role is in the
acs:ram::<userId>:role/<ramrole>
format. Example:acs:ram::119285303511****:role/testpolicyrole
.
NoteAfter you grant permissions to a RAM user or RAM role, you must use the Alibaba Cloud account of the RAM user or RAM role to authorize the RAM user or RAM role to use the secret in RAM. Then, the RAM user or RAM role can use the secret.
For more information, see Use RAM to manage access to KMS resources, Grant permissions to a RAM user, and Grant permissions to a RAM role.
NoteWhen you create an ECS secret, the system automatically creates the AliyunServiceRoleForKMSSecretsManagerForECS service-linked role and attaches the AliyunServiceRolePolicyForKMSSecretsManagerForECS policy to the role. Secrets Manager assumes the role to manage dynamic ECS secrets, such as rotating passwords or SSH key pairs of ECS instances.
You can log on to the RAM console to view the details of service-linked roles and policies. For more information, see View the information about a RAM role and View the basic information about a policy.
Step 2: Install Secrets Manager Client in your application
Secrets Manager Client encapsulates secret cache, best practices, and design patterns based on the Secrets Manager API. This way, you can easily integrate the capabilities of Secrets Manager into business systems. For more information, see Secrets Manager Client.
What to do next
Rotate an ECS secret
You can configure automatic rotation for a secret to reduce the risk of secret leaks. If a secret is leaked, you can immediately rotate the secret in the KMS console to eliminate intrusion risks.
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Secrets.
Click the ECS Secrets tab, select the required instance ID from the Instance ID drop-down list, find the secret that you want to rotate, and then click Details in the Actions column.
Configure a secret rotation policy.
Periodic rotation: In the upper-right corner of the page, click Configure Rotation Policy, enable or disable Automatic Rotation, and then click OK.
Immediate rotation: In the upper-right corner of the page, click Rotate Now. In the Configure Rotation Policy dialog box, turn on or off Use Custom Secrets and then click OK.
If you turn on the switch, you must specify a new secret value.
If you turn off the switch, Key Management Service (KMS) automatically creates a 32-character random password or an RSA-2048 SSH key pair.
Delete an ECS secret
You can immediately delete a secret or create a scheduled task to delete a secret.
Before you delete an ECS secret, make sure that the ECS secret is no longer in use. If you delete a ECS secret that is in use, service failures may occur.
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Secrets.
Click the ECS Secrets tab, select the required instance ID from the Instance ID drop-down list, find the secret that you want to delete, and then click Schedule Deletion in the Actions column.
In the Schedule Deletion dialog box, select a method to delete the secret and click OK.
If you select Schedule Deletion, configure Retention Period (7 to 30 Days). When the scheduled deletion period ends, KMS deletes the secret.
If you select Delete Immediately, the system immediately deletes the secret.
During the scheduled deletion period, you can click Restore Secret in the Actions column to cancel the deletion.
Add tags to secrets
You can use tags to classify and manage secrets. A tag consists of a key-value pair.
A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal sign (=), colons (:), and at signs (@).
A tag key cannot start with aliyun or acs:.
You can configure up to 20 key-value pairs for each secret.
Add tags for a secret
Method | Description |
Method 1: Add tags on the Secrets page |
|
Method 2: Add tags on the Secret Details page |
|
Configure tags for multiple secrets at a time
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Secrets.
Click a tab based on the type of your secret, select the required instance ID from the Instance ID drop-down list, and then select the secrets that you want to manage in the secret list.
Add tags: In the lower part of the secret list, click Add Tag. In the Add Tag dialog box, enter multiple Tag Key and Tag Value, and then click OK. In the message that appears, click Close.
Remove tags: In the lower part of the secret list, click Remove Tag. In the Batch Remove dialog box, select the tags that you want to remove and click Remove. In the message that appears, click Close.